Steve Jobs couldn’t kill it, Microsoft’s Silverlight couldn’t kill it – it seems that Adobe Flash Player is here to stay! Because you will have to support it, you might as well make it as easy as possible. The first step on that road is to deploy Adobe Flash Player with Group Policy. Here is you how to guide:

Be sure to use a generic tech email shared by those in your department. This will make future updates smoother. In our environment, we have a shared IT email called techinfo@.

After applying for the license, you will receive two follow up emails. The first email will confirm your newly created Adobe Distribution account. The second email will include download instructions for the fully packaged MSI. This second email can take several hours to arrive if your Adobe Distribution license is new.

Sharing the Package

Copy the MSI (and any other included files) to your software distribution share. Personally, I like to organize my share like this:

SoftwareShare

Vendor (Adobe)

Application (Flash)

Version (11)

When you organize by vendor, your software share will have a more vertical structure and you won’t seem so cluttered all of the time. As an example, take a look at all of the Adobe Products we deploy in our environment:

Regardless of how your setup your share, be sure that EVERYONE (or an equivalent) has Full Control to the share and that Authenticated Users has Read/Execute on the folder permissions. This will ensure that your objects (either computers or users) have the appropriate permissions needed to access the installation source.

Creating the GPO

For any application that you deploy, create a specific GPO named after the product and pick a prefix to identify the type of GPO it is. I prefer to name my GPOs APP_Application Name. For example, APP_Adobe Flash Player.

There is no need to add the version to the GPO name. You will likely store updates inside this same GPO and will only have to rename the policy later. Save yourself some time and omit the application version.

Be sure to create your new GPO under the Group Policy Objects container. Many of times, I have accidentally deployed an application or setting by right clicking on an OU and creating the GPO there. Until your GPO is fully tested, it should not be in a live environment (or linked to production machines).

Edit the GPO

Edit your newly created Adobe Flash Player Group Policy Object. Because all users tend to use Adobe Flash Player, you will likely deploy it to the computer. Expand your GPO to Computer Configuration/Policies/Software Settings/Software Installation. Right click and select New Package.

Browse to your package and add it to your GPO. Be sure that you browsed to the UNC (share path or \\SERVER\SHARE\) and not a local path (D:\Software\). Select Assigned and Ok.

Disabling Adobe Flash Player Auto Update

The Auto Update settings for Adobe Flash Player can be configured by creating/editing the MMS.CFG file. MMS.CFG can be found here: C:\Windows\System32\Macromed\Flash. This file might not exist on your computers. Don’t worry, we will create it.

Open notepad and enter: AutoUpdateDisable=1

Save this file in the same location as your Adobe Flash Player MSI.

Distribute MMS.CFG

In your Adobe Flash Player Group Policy Object, create a new computer side File Preference. Configure the preference to copy the MMS.CFG file from your network share to C:\Windows\System32\Macromed\Flash\.

You are now ready to deploy Adobe Flash Player with Group Policy! Simply link your new GPO to a Test OU and reboot. Adobe Flash Player should update through Group Policy. After testing, you might want to scope your GPO down to a specific security group instead of Authenticated Users.

Once a week, I hope to highlight a particular application and the methods you can use to deploy it. If you have a particular application that you would like to see in this series, leave me a comment (or send me an email by using the button in the top right of this site).

Thank you Luk! This guide covers the ActivX deployment of Flash. For Firefox, you will just need to follow the same procedures but download the Plug-in based MSI from Adobe. Let me know if you have any more questions.

Hi, thanks, it is working now. But only on Windows 7 workstations. They get both flash plugins installed after reboot, which is what I want. However, Windows 8.1 workstations doesnt get any flash installed. System flash is built in in Windows 8.1, so I dont care about this, but plugin for other browsers doesnt get installed, however gpresult shows that policy is being applied. Any ideas?

If you look in the Application node under Event Viewer, do you see that the MSI was successfully installed? If you run the MSI silently (msiexec /I MSIname.msi /qb) on the Windows 8.1 machine, does it work?

In eventlog there were some timeout warnings and thus policies not applied. Everything is fixed now. Problem was solved, when I applied Computer Configuration \Administrative Templates\System\Logon – Always wait for the network at computer startup and logon and also Computer Configuration\Administrative Templates\System\Group Policy\Startup Policy Processing Wait Time – 30 s. I know it should be default value but setting it for 30s fixed the problem.